CVE-2026-75600

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator accepts an authenticated host parameter and uses it to build a shell command. The code path validates the generated OAuth access token before execution, but it does not validate or escape host. Compromise results in authenticated arbitrary shell command execution as the FreePBX web/PBX service user (typically asterisk.). This issue has been patched in version 17.0.9.

• CWE-78

• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-79rg-3xp6-rqq6Mitigation, Vendor Advisory

Published

Sep 28, 2026

Last Modified

Oct 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75594Kirby is an open-source content management system. Prior to …8.2
• CVE-2026-75595Netty is an asynchronous, event-driven network application f…9.1
• CVE-2026-75596Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-75597pyLoad is a free and open-source download manager written in…5.3
• CVE-2026-75598The Gradle Shadow plugin creates fat or uber JARs and suppor…6.3
• CVE-2026-75599HomeBox is a home inventory and organization system. Prior t…5.4
• CVE-2026-75601Static Web Server (SWS) is a production-ready web server sui…4.3
• CVE-2026-75602OpenList a file list program that supports multiple storage.…6.5
• CVE-2026-75604Next.js is a React framework for building full-stack web app…9
• CVE-2026-75607Frigate is an open source network video recorder. Prior to 0…8.1
• CVE-2026-75608Frigate is an open source network video recorder. Prior to 0…7.7
• CVE-2026-7561The Tm – WordPress Redirection plugin for WordPress is vulne…6.1